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(TS//SI) Terrorists who visit Internet cafes associated with the can now 

potentially be located and arrested. 


(TS//SI) There are a number of terrorists now in prison whose last moments of freedom went 
something like this: Each terrorist woke up in the middle of the night, finding his bed 
surrounded by U.S. troops. As he was detained and dragged out the door of his safehouse, he 
may have wondered, "How did they know I was here?" 

(TS//SI) Answer: SIGINT had detected the terrorist's activity in an Internet cafe earlier that day 
and tipped his location to the appropriate forces in Iraq within minutes of his activity. Then, 
through various means, the target was tracked from the cafe to his safehouse, leading our 
forces not only to him, but also to other members of his terrorist network staying with him. 

(See an earlier SIDtodav article on this topic.) 

(TS//SI) We've had success in targeting cafes over the past year, but until recently there was a 
maj or gap in o ur capabilities. Namely, we could not precisely locate cafes that we re served by 
the^H^^I ISP*, a large, entirely wireless operation. Because of complex 

netwon^tmcture, use of dynamic ip addresses, etc., we could narro^aowrH^iser's location to 
which city he was in - but nothing more precise than that. 


(TS//SI) The picture changed this spring, however, with two important developments. First, in 
late April, we intercepted (via Timberline FORNSAT and TAP collection) the customer database 


for 

installe 


Next, in May, two new systems (WealthyCluster2 and X-KEYSCORE) were 
at SCS Mosul that made it possible to process wireless collection in the region. SIGINT 


now had the capability to intercept signals passing between 
communications towers and the users. 


neighborhood 


(TS//SI) Putting these pie ces of info rmation together, the SIGINT System now had the ability to 
detect terrorist use of the network and to even find the location of the cafe. As the 

SIGINT started coming in, tn^Network Analysis Center (NAC), in coordination with 
Counterterrorism (CT), began issuing tippers with precise locational information to other 
SIGINTers and military customers. 


(TS//SI) The outcome so far has been this: previously un-locatable cafes have been found and at 
least four "wanted" terrorists have been captured. The NAC is working closely with CT to share 
their techniques, and CT is in the process of taking over future responsibility for tipping ^ 

Icafe locations being used by wanted terrorists. 


(TS//SI) Let's hope that we "net" more terrorists at these cafes in the coming months as well! 


POCs: 

(U//FOUO) If you have questions about this topic, please contact ^^^■^^■oftheAd vance 
Network Development & An alysis (ANDA) Iraq Wireless Team (SSG2^^at^^^^^H or the 
team at . 

*(U) Notes: 

ISP = Internet Service Provider 












"(U//FOUO) SIDtoday articles may not be republished or reposted outside NSANet 
without the consent of S0121 (DL sid comms V 
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